- Export to PDF
- Get the short link of this page
- Share this page onTwitterFacebookLinkedin
- EN English
Decision on how the European Union Agency for Cybersecurity (ENISA) carried out two staff selection procedures in the field of cybersecurity (cases 1159/2021/VB and 1224/2021/VB)
Case 1159/2021/VB - Opened on Monday | 15 November 2021 - Decision on Friday | 16 December 2022 - Institution concerned European Union Agency for Cybersecurity ( No further inquiries justified )
Case 1224/2021/VB - Opened on Monday | 15 November 2021 - Decision on Friday | 16 December 2022 - Institution concerned European Union Agency for Cybersecurity ( No further inquiries justified )
The case concerned the way in which the European Union Agency for Cybersecurity (ENISA) carried out two selection procedures to recruit experts in the field of cybersecurity who would fit one or more of three profiles. The complainant took part in both procedures and raised concerns about the scoring methodology applied by ENISA and the inconsistency of the scores he received in one procedure.
In the course of the inquiry, the Ombudsman inquiry team noted that the scoring methodology used in both procedures put candidates applying for one or two profiles only at a disadvantage in comparison to those who applied for all three profiles. This was not clear in the vacancy notices. It also requested explanations to ENISA on the inconsistencies in the complainant’s scores.
ENISA acknowledged the inconsistencies in the scores received by the complainant and offered to invite him to the next stage of both selection procedures.
The Ombudsman found that, as ENISA has taken appropriate steps to remedy the issues raised by the complainant, no further inquiries are justified in this case and closed the inquiry.
Background to the complaint
1. The complainant took part in two selection procedures for the recruitment of EU staff organised by the European Union Agency for Cybersecurity (ENISA). Both procedures were organised to recruit experts who would fit one or more of three cybersecurity profiles described in the vacancy notices. In both procedures, the complainant applied for profiles A and B only.
2. The selection procedure for temporary agents was launched at three different grades (AD 6, AD 7 and AD 8) with the aim of establishing a shortlist of 75 candidates from which ENISA could recruit them (the ‘reserve list’). Candidates could apply to one or more grades, as far as they met the eligibility requirements for each grade. The selection procedure for contract agents was aimed at establishing a reserve list of 24 candidates.
3. In both selection procedures, candidates were requested to provide a CV and complete a ‘talent screener’. In the talent screener, candidates have to answer questions about their professional experience and qualifications. The questions are based on the selection criteria for the selection procedure. The ‘selection board’ then assesses and scores the candidates’ answers.
4. ENISA informed the complainant that he was not admitted to the final stage of either selection procedures, which consisted of an interview and written test. This is because, on the basis of the complainant’s answers in the talent screener and of the information in his CV, the selection boards gave the complainant a score below the threshold required to be admitted to the next stage of the selection procedures.
5. Following the complainant’s request for feedback on the rejection of his applications, ENISA provided him with information regarding, for both procedures, the threshold to be invited to the next stage, the weight of each selection criterion, the total number of candidates and the number of shortlisted ones. ENISA also informed the complainant of the breakdown of his scores.
6. In both selection procedures, candidates could score maximum 100 points. In the selection procedure for temporary agents, the threshold to be invited to the following stage was 72 points at AD 6 level, 55 at AD 7, and 74 at AD 8 (out of 100). The complainant scored 65, 25 and 26 points at AD 6, AD 7 and AD 8 respectively. In the selection procedure for contract agents, the threshold to be invited to the following stage of the procedure was 71 points out of 100. The complainant scored 70 points.
7. In February 2021, the complainant submitted two administrative complaints to ENISA. The complainant took issue with the scoring method used by the selection boards in both procedures and the lack of clarity of the vacancy notices.
8. In particular, the complainant noted that both vacancy notices said that ENISA was looking for candidates “that fit into one or more” of the three profiles. He argued that, as a candidate could receive 25 points for their experience under each profile, only candidates who had applied for all three profiles could score the maximum 75 points for professional experience. The scoring system thus penalised those candidates who applied for the one or two profile(s) that best fitted their experience only. However, nothing in the vacancy notices suggested that the candidates’ professional experience would be evaluated on the basis of all three profiles cumulatively. The vacancy notices led candidates to believe that they could be successful in the procedures, even if they had applied for one profile only.
9. The complainant also noted that, before submitting his applications, he had requested clarifications from ENISA on how professional experience would be assessed, but ENISA replied that it could not indicate whether candidates were supposed to apply for all three profiles or could select the ones that best matched their experience.
10. Regarding the selection procedure for contract agents, ENISA invited to the written test and interview the best twelve candidates for each profile and the best twelve candidates, different from the previous ones, with high scores across the profiles. It awarded the maximum points to the complainant’s experience under profiles A and B, and gave him a very high score under the other criteria. In the complainant’s view, the only plausible reason why he was not included among the top 12 candidates for profiles A and B was that he was penalised for not having applied for profile C as well.
11. Regarding the selection procedure for temporary agents, the complainant took issue with the scores received. In particular, he found it questionable that he had received more points at AD 8 level, where at least 9 years of professional experience were requested, than at AD 7 level, which required only 6 years of experience.
12. ENISA rejected both administrative complaints. It said that selection boards weighted each criterion according to its relevance to the duties described in the vacancy notices and applied the scoring methodology set out in the vacancy notices. It added that the selection boards assessed the complainant’s applications on the basis of the information provided in his CV and talent screener, by applying the scoring methodology established in advance.
13. The scores received by the complainant are the expression of the value judgement of the selection boards on how well the information in the talent screener and CV matched the pre-established methodology. If the methodology is decided in advance, the marks awarded to candidates on the basis of their experience and qualifications cannot be challenged.
14. ENISA said that the complainant’s argument that he was not invited to the next stage of the competition because candidates’ experience was evaluated cumulatively for all profiles was not grounded.
15. Regarding the selection procedure for contract agents, ENISA said that the complainant was not invited to the next stage of the selection procedure because he was not awarded any points under the ‘certification criterion’, thus being unable to reach the required threshold. Regarding the selection procedure for temporary agents, the complainant had not provided sufficient evidence of “links to the relevant type of cybersecurity experience”.
16. Dissatisfied with ENISA’s reply, the complainant turned to the Ombudsman in June and July 2021.
17. The Ombudsman opened an inquiry into the complaint.
18. In the course of the inquiry, the Ombudsman inquiry team inspected ENISA’s file related to the selection procedures and met with ENISA’s representatives. The Ombudsman also received ENISA’s reply on the inquiry team request for reply and, subsequently, the comments of the complainant on the inspection and meeting report and on ENISA’s reply.
The inspection of documents and meeting with ENISA’s representatives
Arguments presented to the Ombudsman
The wording used in the vacancy notices and the scoring system applied
19. ENISA explained that, in the selection procedure for temporary agents, candidates could obtain a maximum of 25 points per profile and 25 additional points on the basis of (a) candidates’ academic qualification (5 points), (b) experience in contributing to or coordinating projects involving a variety of stakeholders (15 points) and (c) international/multicultural experience within the areas identified in the vacancy notices.
20. The selection procedure for contract agents was divided in two phases. In the first phase, all candidates who had scored at least 46 points out of 50 were included in the lists for profile A (11 candidates) and B (9 candidates). For profile C, in the first phase, 12 candidates who scored 46 points were added to the list. In the second phase, and in order to reach the number of 12 candidates in profiles A and B, the selection board included candidates who scored an average of at least 71 points in total, while at the same time scoring higher in the profile in question than in the other two profiles. The top 12 candidates across profiles were candidates who scored at least 71 points in total and were not included in the list of top candidates per profile.
21. ENISA explained that its goal was to recruit candidates with professional experience in a specific area, but who could also work on other policy areas if needed. Since the positions were all for complementary operational posts closely related to cybersecurity, ENISA decided to bundle all profiles in one selection procedure, in order to have a longer list of possible candidates and be able to quickly cover the positions it had available.
22. Specialists in cybersecurity could easily fit all three profiles, which were not mutually exclusive, and had thus the possibility to obtain a higher score in the procedures if they applied for several profiles. Candidates could understand this and apply for multiple profiles, as did the complainant himself, who applied for two.
23. The complainant said that the scoring systems applied favoured candidates who had applied for multiple profiles, as they could reach higher scores than candidates applying for one or two profiles only. Nothing in the vacancy notices indicated that candidates applying for more than one profile would have had an advantage over other candidates.
24. Regarding the selection procedure for temporary agents, the complainant noted that candidates could only reach the threshold by applying for several profiles. He had applied for two profiles because they were the ones he preferred and for which he was best fitted. Had he known that he could get additional points by applying also to profile C, he would have done so.
25. On the contrary, the scoring methodology applied in the selection procedure for contract agents enabled candidates who applied for one profile only to be shortlisted, provided they scored sufficiently high in that profile. However, the last one of the best twelve candidates for profile A and the last three for profile B were selected on the basis of their scores across profiles, which disadvantaged candidates who would have been next on the list had the score per profile been the only criterion taken into account.
26. Considering that, in the first phase, the complainant had missed the threshold for profiles A and B by one point only, had the second phase not focused on the total average score across profiles he would have probably been included among the top twelve candidates for both profiles.
The complainant’s scores in the selection procedure for temporary agents
27. ENISA explained that in the selection procedure for temporary agents, there were three different selection boards, one per grade, which would establish three separate reserve lists.
28. The selection boards for grades AD 6 and AD 8 recognised most of the complainant’s experience as relevant to one or more profiles. However, the selection board for grade AD 7 considered as relevant only part of the complainant’s professional experience, which was not sufficient to award him any points.
29. ENISA also said that, even if the selection board for grade AD 7 had recognised as relevant experience the same number of years as the other selection boards, the complainant would not have reached the threshold for being shortlisted.
30. The complainant noted that the description of profiles A, B and C was identical for all three grades and so were the areas in which candidates had to demonstrate to have relevant professional experience. The complainant argued that, in the context of a single selection procedure, it is wrong to apply different criteria at each grate to assess the relevance of candidates’ professional experience.
31. He also took issue with the decision of the selection board not to consider some of his professional experience relevant at grade AD 7. He argued that had he received an higher score an AD 7 level, he could have reached the threshold required to be shortlisted.
The Ombudsman’s request for reply
32. Following the inspection and meeting, the Ombudsman inquiry team requested further clarifications from ENISA. It noted that the scoring methodology used in both procedures put candidates applying for one or two profiles only at a disadvantage in comparison to those who applied for all three profiles. The vacancy notices did not clearly indicate that candidates applying for all three profiles would receive more points.
33. Regarding the selection procedure for temporary agents, the Ombudsman considered that the complainant’s scores at grades AD 6, AD 7 and AD 8 could be clearly perceived as inconsistent, and that such inconsistency arose because there was a different selection board per grade. On the basis of the inspected documents, the inquiry team noted that had the complainant been recognised at grade AD 6 and 7 the same amount of experience under profile B that he was recognised at grade AD 8, he could have reached the threshold. Also at AD 7 level, the complainant could have reached the threshold had the selection board recognised, for profile A, the same experience accepted at AD 6 level and, for profile B, the experience recognised at AD 8 level.
34. ENISA said that the selection boards had taken concrete measures to guarantee equal treatment of all candidates. However, it acknowledged the inconsistencies pointed out by the inquiry team.
35. As a form of redress, ENISA proposed to invite the complainant to the following stage of both selection procedures, namely the interview and written test. For the selection procedure for temporary agents, ENISA proposed to invite the complainant to take the interview and written test at the highest possible grade, AD 8.
36. The complainant is satisfied that the ENISA finally acknowledged the issues that he had raised and that it decided to invite him to the interview and written test in both procedures. However, he is concerned that, in case he is successful, he will have fewer chances to be recruited than other successful candidates had. He said that the reserve lists are set to expire at the end of 2022 and ENISA has already recruited several candidates. In addition, if the scores obtained in the first phase remain relevant at later stages of the procedures, the complainant would be at a disadvantage in comparison to candidates who had applied for profile C as well. Lastly, he said that, as in the selection procedure for temporary agents he had applied for all three grades, it would have been more appropriate to invite him to the interview and written test at all three grades.
The Ombudsman’s assessment
The wording used in the vacancy notices and the scoring systems applied
37. According to EU case law, the vacancy notice constitutes a legal framework which the EU body imposes on itself. Its essential role is to inform the persons concerned, as accurately as possible, of the nature of the conditions required to occupy the position in question” (emphasis added).
38. In both vacancy notices, ENISA indicated that it was “looking for candidates that fit into one or more of the following profiles” (emphasis added), and described the knowledge and experience required for each profile. Nothing in the vacancy notices suggested that candidates applying for more than one profile would receive more points. Despite the lack of a clear indication in the vacancy notices in this regard, both selection procedures privileged candidates who had applied for multiple profiles, to the detriment of those who had applied to fewer ones.
39. In both the selection procedures, candidates would lose 25 points for each of the profiles for which they did not apply. In the selection procedure for temporary agents, this scoring system would make it significantly more difficult, if not impossible, for candidates applying for one or two profiles only to reach the thresholds established to be shortlisted. A candidate applying for one profile only would not be able to reach the threshold for any of the three grades, even if they scored the maximum points under that profile. A candidate applying for two profiles would also be at a disadvantage compared to candidates who applied for all three profiles, as they could not score higher than 75 points.
40. In the selection procedure for contract agents, it was possible for candidates applying to one profile only to be shortlisted, since they could be included among the top twelve candidates for the profile in question, provided they reached the required threshold. However, candidates not applying for all three profiles could not be selected for the top twelve candidates across profiles, as the threshold was 71 points, nor for the last positions under profiles A and B. This put candidates applying to one or two profiles at a disadvantage.
41. Recruiting bodies can determine their recruitment needs and identify what should be the profile of successful candidates. In this sense, ENISA could take the view that it needed candidates that could fit all three profiles, thus giving preference to those with experience across the three profiles, as far as this could be understood from the vacancy notices. However, given the wording of the two vacancy notices, it was not reasonable to expect candidates to understand that applying for multiple profiles would give them the possibility to obtain more points, as the notices merely referred to candidates that could “fit into one or more” profiles.
42. Not being aware that ENISA wanted to prioritise candidates with experience across all profiles, the complainant decided not to apply for Profile C. He thus missed points that could have allowed him to reach the relevant thresholds to be admitted to the following stages of both selection procedures. This would not have happened if ENISA had been clearer in the vacancy notices as to the fact that preferences would have been given to candidates fitting more profiles.
43. In addition, the complainant had raised this issue with ENISA already in his administrative complaints and asked for clarifications before submitting his applications. It is regrettable that ENISA rejected the complainant’s arguments as not grounded instead of taking action already at that stage to address the complaint without the involvement of the Ombudsman.
44. However, by deciding to invite the complainant to the following stage of both selection procedures, ENISA has now taken appropriate steps to remedy the issue. Regarding the complainant’s concerns about the fact that should he be successful in the next stage of the procedures, he might be in a disadvantaged position vis à vis other successful candidates, these are hypothetical. The Ombudsman trusts that should the complainant be successful in the remaining steps of the procedures, ENISA would take appropriate measures to ensure that he is not put in a disadvantageous position.
The complainant’s scores in the procedure for temporary agents
45. The Ombudsman takes note of ENISA’s explanation that the inconsistency in the assessment of the complainant’s experience across all three grades was due to the fact that there were three different selection boards, one per grade.
46. In assessing candidates, selection boards are bound by the selection criteria for the selection procedure in question. At the same time, according to EU case law, selection boards have a wide margin of discretion when assessing a candidate’s qualifications and professional experience against those criteria. In practice, this discretion implies that different selection boards might reach diverging conclusion as to the relevance of a candidate’s professional experience for a certain position. While this does not necessarily imply that any of the boards committed a manifest error of assessment, it is evident that, when this happens in the context of the same selection procedure, it can be very confusing for candidates.
47. In this case, ENISA did not provide a clear explanation as to why it considered necessary to have three different selection boards in the same selection procedure. While there might be valid reasons that could justify the presence of multiple selection boards in the same procedure, institutions should, in principle, avoid this situation to limit the risk of inconsistency in the evaluation of candidates’ applications.
48. The Ombudsman notes that the complainant had brought to ENISA’s attention the inconsistency in his scores already in his administrative complaint. ENISA could have taken action already at that stage to address this issue without the involvement of the Ombudsman.
49. By deciding to invite the complainant to the following stage of the selection procedure, ENISA has now taken appropriate steps to remedy the issue. It is thus not necessary to assess whether the inconsistencies were caused by a manifest error of assessment of the selection boards or not nor if it was justified to have multiple selection boards in this procedure.
Based on the inquiry, the Ombudsman closes this case with the following conclusion:
No further inquiries into the complaints are justified.
The complainant and ENISA will be informed of this decision.
Head of the Case-handling Unit
 Call for Expression of Interest for Temporary Agents, Administrators (AD) - Grade AD6, AD7, AD8 (Ref. ENISA-TA-AD-2020-01): https://www.enisa.europa.eu/recruitment/enisa-ta-ad-2020-01_call-for-expression-of-interest-for-ta; Call for Expression of Interest for Contract agents 3A, Function Group - FGIV (Ref. ENISA-CA-FGIV-2020-02): https://www.ypes.gr/wp-content/uploads/2020/04/ENISA-CA-FGIV-2020-02_Call-for-expression-of-interest-for-Contract-Agents-3a.pdf.
 Profile A “knowledge and experience in cybersecurity”; profile B “Sectorial ICT technical or ICT policy knowledge and experience, and proven professional understanding of cybersecurity issues”; Profile C “Good background in economics, law, communication, social sciences, EU public sector, etc. with relevant link to cybersecurity”.
 The selection criteria are defined in the ‘notice of competition’, which sets out the criteria and rules applying to the selection procedure.
 Each selection procedure has a selection board, which is responsible for selecting candidates at each stage, based on pre-determined criteria, and drawing up the final list of successful candidates.
 For more information on the talent screener, see https://epso.europa.eu/help/faq/2711_en.
 Candidates could score 25 points for their experience under each profile (for a total of 75 points) and 25 points under the remaining criteria.
 The complainant’s points at AD 7 and AD 8 level were corrected after the decision was issued.
 At AD 6 level, the complainant’s experience was awarded 25 points under profile A and 15 points under profile B. At AD 7 level, the complainant scored 0 points for his professional experience. At AD 8 level, the complainant’s experience was awarded 5 points under profile B and 0 points under profile A.
 The complainant’s experience was awarded 25 points both under profile A and B.
 Article 90(2) Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501.
 The complainant scored a total of 45 points in both profiles A and B.
 See Judgement of the General Court of 8 May 2019, Grigorios Stamatopoulos v ENISA, T-99/18, paragraph 36: https://curia.europa.eu/juris/document/document.jsf?text=&docid=213849&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=774459.
 See Judgement of the Court of First Instance (Second Chamber) of 13 March 2002, Laurent Val v Commission, T-139/00, paragraph 35: https://eur-lex.europa.eu/legal-content/HR/TXT/?uri=CELEX:62000TJ0139
 See Judgment of the General Court of 11 February 1999, Mertens v Commission, T-244/97, paragraph 44: https://eur-lex.europa.eu/legal-content/HR/TXT/?uri=CELEX:61997TJ0244; Judgment of the General Court of 11 May 2005, De Stefano v Commission, T-25/03, paragraph 34: http://curia.europa.eu/juris/celex.jsf?celex=62003TJ0025&lang1=en&type=TXT&ancre=.
 This complaint has been dealt with under delegated case handling, in accordance with the Decision of the European Ombudsman adopting Implementing Provisions
- Export to PDF
- Get the short link of this page
- Share this page onTwitterFacebookLinkedin